feat(ads): server-driven ad-banner backend, wire & admin console (PR1)

Turn the gated-off mock banner into a real advertising subsystem (backend +
admin half; the UI rotation lands in PR2).

- internal/ads: campaigns (percent weight + validity window; a perpetual,
  undeletable default that fills the remainder up to 100%), 1..N bilingual
  messages (en+ru), global display timings; ActiveSet computes the
  window-filtered, default-remainder, GCD-reduced, language-resolved rotation
  feed. Smooth-weighted-round-robin math is unit-tested.
- migration 00006 (+ jetgen): ad_campaigns / ad_messages / ad_settings, seeded
  default campaign + house message + default timings.
- eligibility = !paid_account && hint_balance==0 && !no_banner role (new role;
  guests qualify). The resolved feed rides the profile.get response (no new RPC,
  works for guests, nothing distinct to filter); language by service_language.
- live update: a notify `banner` sub-kind (re-poll signal) published when an
  operator grants hints or grants/revokes no_banner, so the client shows/hides
  in place.
- admin console /_gm/banners (+ /_gm/banner-settings): campaign + message CRUD
  with reorder, default protection, clamped timings.
- wire: fbs BannerInfo/BannerCampaign on Profile; gateway transcode forwards it.
- docs: ARCHITECTURE §10, FUNCTIONAL (+ _ru), backend README, PRERELEASE tracker
  (incl. the deferred app.load aggregator note).

backend/README.md

@@ -101,7 +101,13 @@ broadcast picks the delivering bot by an operator-chosen language. `accounts.ser
 holds the language tag of the bot a Telegram
 user last signed in through, written on every login and returned by
 `/internal/push-target` (falling back to `preferred_language`) so out-of-app push routes
-to the right bot. The shared wire contracts live in the sibling [`../pkg`](../pkg) module.
+to the right bot. The console also manages the **advertising banner** (`/_gm/banners` +
+`/_gm/banner-settings`, `internal/ads`): operator campaigns with a percent weight, an optional
+window and bilingual messages, plus the global display timings. `GET /api/v1/user/profile` attaches
+the resolved, weighted campaign feed for an **eligible** viewer (`!paid_account && hint_balance == 0
+&& !no_banner` role, the message language picked by `service_language`); changing those inputs
+publishes a `notify` `banner` re-poll signal so the client shows/hides it in place. The shared wire
+contracts live in the sibling [`../pkg`](../pkg) module.
 
 **Account linking & merge** (`/api/v1/user/link/*`). `internal/link`
 orchestrates it: an email confirm-code or a gateway-validated Telegram identity is
@@ -145,6 +151,7 @@ internal/feedback/   # user feedback: messages + attachment (bytea), anti-spam g
 internal/lobby/      # auto-match (DB-backed open games + robot substitution) + friend-game invitations
 internal/robot/      # human-like robot opponent: account pool, seed-derived strategy, move driver
 internal/adminconsole/ # server-rendered admin console (Go templates + embedded CSS, view models), served at /_gm
+internal/ads/        # advertising banner: campaigns + bilingual messages + display timings, weighted-rotation feed (ActiveSet)
 internal/connector/  # backend gRPC client to the Telegram connector (operator broadcasts)
 internal/ratewatch/  # gateway rate-limit reports: episode window for the console + the high-rate auto-flag
 ```